github.com/incognitochain/go-incognito-sdk@v1.0.1/privacy/curve25519/key.go

// Copyright 2017-2018 DERO Project. All rights reserved.
// Use of this source code in any form is governed by RESEARCH license.
// license can be found in the LICENSE file.
// GPG: 0F39 E425 8C65 3947 702A  8234 08B2 0360 A03A 9DE8
//
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY
// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package curve25519

import (
	"io"
)
import "fmt"
import "bytes"
import "crypto/rand"
import "encoding/hex"
import "encoding/binary"

const KeyLength = 32

// Key can be a Scalar or a Point
type Key [KeyLength]byte

func (k Key) MarshalText() ([]byte ) {
	return []byte(fmt.Sprintf("%x", k[:]))
}

func (k *Key) UnmarshalText(data []byte) (err error) {
	byteSlice, _ := hex.DecodeString(string(data))
	if len(byteSlice) != 32 {
		return fmt.Errorf("Incorrect key size")
	}
	copy(k[:], byteSlice)
	return
}

func (k Key) String() string {
	return fmt.Sprintf("%x", k[:])
}

func (p *Key) FromBytes(b [KeyLength]byte) {
	*p = b
}

func (p *Key) ToBytes() (result [KeyLength]byte) {
	result = [KeyLength]byte(*p)
	return
}

// convert a hex string to a key
func HexToKey(h string) (result Key) {
	byteSlice, _ := hex.DecodeString(h)
	if len(byteSlice) != 32 {
		panic("Incorrect key size")
	}
	copy(result[:], byteSlice)
	return
}

func HexToHash(h string) (result Hash) {
	byteSlice, _ := hex.DecodeString(h)
	if len(byteSlice) != 32 {
		panic("Incorrect key size")
	}
	copy(result[:], byteSlice)
	return
}

// generates a public from the secret key
func (p *Key) PublicKey() (pubKey *Key) {
	point := new(ExtendedGroupElement)
	GeScalarMultBase(point, p)
	pubKey = new(Key)
	point.ToBytes(pubKey)
	return
}

// tests whether the key is valid ( represents a point on the curve )
// this is equivalent to bool crypto_ops::check_key(const public_key &key)
func (k *Key) Public_Key_Valid() bool {
	var point ExtendedGroupElement
	return point.FromBytes(k)
}

func (k *Key) Private_Key_Valid() bool {
	return Sc_check(k)
}

// Creates a point on the Edwards Curve by hashing the key
func (p *Key) HashToEC() (result *ExtendedGroupElement) {
	result = new(ExtendedGroupElement)
	var p1 ProjectiveGroupElement
	var p2 CompletedGroupElement
	h := Key(Keccak256(p[:]))
	p1.FromBytes(&h)

	// fmt.Printf("p1 %+v\n", p1)
	GeMul8(&p2, &p1)
	p2.ToExtended(result)
	return
}

func (p *Key) HashToPoint() (result *Key) {
	if result == nil {
		result = new(Key)
	}
	extended := p.HashToEC()
	extended.ToBytes(result)
	return
}

// compatible with hashToPointSimple
// NOTE: this is incompatible with HashToPoint ( though it should have been)
// there are no side-effects or degradtion of curve25519, due to this
// however, the mistakes have to kept as they were in original code base
// this function is only used to generate H from G
func (p *Key) HashToPointSimple() (result Key) {
	h := Key(Keccak256(p[:]))
	extended := new(ExtendedGroupElement)
	extended.FromBytes(&h)

	// convert extended to projective
	var p1 ProjectiveGroupElement

	extended.ToProjective(&p1)
	var p2 CompletedGroupElement

	GeMul8(&p2, &p1)
	p2.ToExtended(extended)
	extended.ToBytes(&result)
	return
}

// this uses random number generator from the OS
func RandomScalar() (result *Key) {
	result = new(Key)
	var reduceFrom [KeyLength * 2]byte
	tmp := make([]byte, KeyLength*2)
	rand.Read(tmp)
	copy(reduceFrom[:], tmp)
	ScReduce(result, &reduceFrom)
	return
}

// generate a new private-public key pair
func NewKeyPair() (privKey *Key, pubKey *Key) {
	privKey = RandomScalar()
	pubKey = privKey.PublicKey()
	return
}

func ParseKey(buf io.Reader) (result Key, err error) {
	key := make([]byte, KeyLength)
	if _, err = buf.Read(key); err != nil {
		return
	}
	copy(result[:], key)
	return
}

/*
   //does a * G where a is a scalar and G is the curve basepoint
    key scalarmultBase(const key & a) {
        ge_p3 point;
        key aG;
        sc_reduce32copy(aG.bytes, a.bytes); //do this beforehand
        ge_scalarmult_base(&point, aG.bytes);
        ge_p3_tobytes(aG.bytes, &point);
        return aG;
    }
*/
//does a * G where a is a scalar and G is the curve basepoint

func ScalarmultBase(a *Key) (aG *Key) {
	reduce32copy := a
	ScReduce32(reduce32copy)
	point := new(ExtendedGroupElement)
	GeScalarMultBase(point, a)
	aG = new(Key)
	point.ToBytes(aG)
	return aG
}

// generates a key which can be used as private key or mask
// this function is similiar to  RandomScalar except for reduce32, TODO can we merge both
func skGen() Key {
	skey := RandomScalar()
	ScReduce32(skey)
	return *skey
}
func SkGen() Key {
	return skGen()
}

func (k *Key) SignedRadix16() [64]int8 {
	if k[31] > 127 {
		panic("scalar has high bit set illegally")
	}

	var digits [64]int8

	// Compute unsigned radix-16 digits:
	for i := 0; i < 32; i++ {
		digits[2*i] = int8(k[i] & 15)
		digits[2*i+1] = int8((k[i] >> 4) & 15)
	}

	// Recenter coefficients:
	for i := 0; i < 63; i++ {
		carry := (digits[i] + 8) >> 4
		digits[i] -= carry << 4
		digits[i+1] += carry
	}

	return digits
}

func (k *Key) ToExtended() (result *ExtendedGroupElement) {
	result = new(ExtendedGroupElement)
	result.FromBytes(k)
	return
}

// bothe the function resturn identity of the ed25519 curve
func identity() (result *Key) {
	result = new(Key)
	result[0] = 1
	return
}

func CurveIdentity() (result Key) {
	result = Identity
	return result
}

func CurveOrder() (result Key) {
	result = L
	return result
}

// convert a uint64 to a scalar
func d2h(val uint64) (result *Key) {
	result = new(Key)
	for i := 0; val > 0; i++ {
		result[i] = byte(val & 0xFF)
		val /= 256
	}
	return
}

func HashToScalar(data ...[]byte) (result *Key) {
	result = new(Key)
	*result = Key(Keccak256(data...))
	ScReduce32(result)
	return
}

// does a * P where a is a scalar and P is an arbitrary point
func ScalarMultKey(Point *Key, scalar *Key) (result *Key) {
	var P ExtendedGroupElement
	P.FromBytes(Point)
	var resultPoint ProjectiveGroupElement
	GeScalarMult(&resultPoint, scalar, &P)
	result = new(Key)
	resultPoint.ToBytes(result)
	return
}
// multiply a scalar by H (second curve point of Pedersen Commitment)
func ScalarMultH(scalar *Key) (result *Key) {
	h := new(ExtendedGroupElement)
	h.FromBytes(&H)
	resultPoint := new(ProjectiveGroupElement)
	GeScalarMult(resultPoint, scalar, h)
	result = new(Key)
	resultPoint.ToBytes(result)
	return
}

// add two points together
func AddKeys(sum, k1, k2 *Key) {
	a := k1.ToExtended()
	var b CachedGroupElement
	k2.ToExtended().ToCached(&b)
	var c CompletedGroupElement
	geAdd(&c, a, &b)
	var tmp ExtendedGroupElement
	c.ToExtended(&tmp)
	tmp.ToBytes(sum)
	return
}

// compute a*G + b*B
func AddKeys2(result, a, b, B *Key) {
	BPoint := B.ToExtended()
	var RPoint ProjectiveGroupElement
	GeDoubleScalarMultVartime(&RPoint, b, BPoint, a)
	RPoint.ToBytes(result)
	return
}

//addKeys3
//aAbB = a*A + b*B where a, b are scalars, A, B are curve points
//B must be input after applying "precomp"
func AddKeys3(result *Key, a *Key, A *Key, b *Key, B_Precomputed *[8]CachedGroupElement) {
	var A_Point ExtendedGroupElement
	A_Point.FromBytes(A)

	var result_projective ProjectiveGroupElement
	GeDoubleScalarMultPrecompVartime(&result_projective, a, &A_Point, b, B_Precomputed)
	result_projective.ToBytes(result)

}

//addKeys3_3  this is similiar to addkeys3 except it allows for use of precomputed A,B
//aAbB = a*A + b*B where a, b are scalars, A, B are curve points
//A,B must be input after applying "precomp"
func AddKeys3_3(result *Key, a *Key, A_Precomputed *[8]CachedGroupElement, b *Key, B_Precomputed *[8]CachedGroupElement) {
	var result_projective ProjectiveGroupElement
	GeDoubleScalarMultPrecompVartime2(&result_projective, a, A_Precomputed, b, B_Precomputed)
	result_projective.ToBytes(result)

}

// subtract two points A - B
func SubKeys(diff, k1, k2 *Key) {
	a := k1.ToExtended()
	b := new(CachedGroupElement)
	k2.ToExtended().ToCached(b)
	c := new(CompletedGroupElement)
	geSub(c, a, b)
	tmp := new(ExtendedGroupElement)
	c.ToExtended(tmp)
	tmp.ToBytes(diff)
	return
}

// zero fill the key
func Sc_0(k *Key) {
	for i := 0; i < 32; i++ {
		k[i] = 0
	}
}

// RandomPubKey takes a random scalar, interprets it as a point on the curve
//  remember the low order bug and do more auditing of the entire thing
func RandomPubKey() (result *Key) {
	result = new(Key)
	p3 := new(ExtendedGroupElement)
	var p1 ProjectiveGroupElement
	var p2 CompletedGroupElement
	h := RandomScalar()
	p1.FromBytes(h)
	GeMul8(&p2, &p1)
	p2.ToExtended(p3)
	p3.ToBytes(result)
	return
}

// this is the main key derivation function and is the crux
// when deriving keys in the case user  A wants to send DERO to another user B ( this is outgoing case)
// public key is B's view key
// private keys is TX private key
// if user B wants to derive key, he needs to   ( this is incoming case )
// public key is TX public key
// private is B's private keys
// HOPE the above is  clean and clear

func KeyDerivation(pub *Key, priv *Key) (KeyDerivation Key) {
	var point ExtendedGroupElement
	var point2 ProjectiveGroupElement
	var point3 CompletedGroupElement

	if !priv.Private_Key_Valid() {
		panic("Invalid private key.")
	}
	tmp := *pub
	if !point.FromBytes(&tmp) {
		panic("Invalid public key.")
	}

	tmp = *priv
	GeScalarMult(&point2, &tmp, &point)
	GeMul8(&point3, &point2)
	point3.ToProjective(&point2)

	point2.ToBytes(&tmp)
	return tmp
}

// the origincal c implementation needs to be checked for varint overflow
// we also need to check the compatibility of golang varint with cryptonote implemented varint
// outputIndex is the position of output within that specific transaction
func (k *Key) KeyDerivationToScalar(outputIndex uint64) (scalar *Key) {
	tmp := make([]byte, 12, 12)

	length := binary.PutUvarint(tmp, outputIndex)
	tmp = tmp[:length]

	var buf bytes.Buffer
	buf.Write(k[:])
	buf.Write(tmp)
	scalar = HashToScalar(buf.Bytes())
	return
}

// generate ephermal keys  from a key derivation
// base key is the B's public spend key or A's private spend key
// outputIndex is the position of output within that specific transaction
func (kd *Key) KeyDerivation_To_PublicKey(outputIndex uint64, baseKey Key) Key {

	var point1, point2 ExtendedGroupElement
	var point3 CachedGroupElement
	var point4 CompletedGroupElement
	var point5 ProjectiveGroupElement

	tmp := baseKey
	if !point1.FromBytes(&tmp) {
		panic("Invalid public key.")
	}
	scalar := kd.KeyDerivationToScalar(outputIndex)
	GeScalarMultBase(&point2, scalar)
	point2.ToCached(&point3)
	geAdd(&point4, &point1, &point3)
	point4.ToProjective(&point5)
	point5.ToBytes(&tmp)
	return tmp
}

// generate ephermal keys  from a key derivation
// base key is the A's private spend key
// outputIndex is the position of output within that specific transaction
func (kd *Key) KeyDerivation_To_PrivateKey(outputIndex uint64, baseKey Key) Key {
	if !baseKey.Private_Key_Valid() {
		panic("Invalid private key.")
	}
	scalar := kd.KeyDerivationToScalar(outputIndex)

	tmp := baseKey
	ScAdd(&tmp, &tmp, scalar)

	return tmp
}

// NewKeyImage creates a new KeyImage from the given public and private keys.
// The keys are usually the ephemeral keys derived using KeyDerivation.
func GenerateKeyImage(pub Key, private Key) Key {
	var proj ProjectiveGroupElement

	ext := pub.HashToEC()
	GeScalarMult(&proj, &private, ext)

	var ki Key
	proj.ToBytes(&ki)
	return ki
}

func PreComputeForMultiScalar (p *Key) [8]CachedGroupElement {
	// A,2A,3A,4A,5A,6A,7A,8A
	var Ai [8]CachedGroupElement
	var A ExtendedGroupElement
	t := new(CompletedGroupElement)
	u := new(ExtendedGroupElement)

	A.FromBytes(p)
	A.ToCached(&Ai[0])
	for j := 0; j < 7; j++ {
		geAdd(t, &A, &Ai[j])
		t.ToExtended(u)
		u.ToCached(&Ai[j+1])
	}
	return Ai
}


func MultiScalarMultKeyCached(AiLs [][8]CachedGroupElement, scalars []*Key, ) (result *Key) {
	r := new(ProjectiveGroupElement)

	digitsLs := make([][64]int8, len(scalars))
	for i:= range digitsLs {
		digitsLs[i] = scalars[i].SignedRadix16()
	}

	t := new(CompletedGroupElement)
	u := new(ExtendedGroupElement)

	r.Zero()
	cachedBase := new(ExtendedGroupElement)
	cur := new(CachedGroupElement)
	minusCur := new(CachedGroupElement)
	for i := 63; i >= 0; i-- {
		r.Double(t)
		t.ToProjective(r)
		r.Double(t)
		t.ToProjective(r)
		r.Double(t)
		t.ToProjective(r)
		r.Double(t)
		t.ToExtended(u)

		cachedBase.Zero()
		tmpt := new(CompletedGroupElement)
		for j:= 0; j < len(scalars); j++ {
			cur.Zero()
			b := digitsLs[j][i]
			bNegative := int8(negative(int32(b)))
			bAbs := b - (((-bNegative) & b) << 1)

			for k := int32(0); k < 8; k++ {
				if equal(int32(bAbs), k+1) == 1 { // optimisation
					CachedGroupElementCMove(cur, &AiLs[j][k], equal(int32(bAbs), k+1))
				}
			}
			FeCopy(&minusCur.yPlusX, &cur.yMinusX)
			FeCopy(&minusCur.yMinusX, &cur.yPlusX)
			FeCopy(&minusCur.Z, &cur.Z)
			FeNeg(&minusCur.T2d, &cur.T2d)
			CachedGroupElementCMove(cur, minusCur, int32(bNegative))

			geAdd(tmpt, cachedBase, cur)
			tmpt.ToExtended(cachedBase)
		}
		tmpv := new(CachedGroupElement)
		cachedBase.ToCached(tmpv)
		geAdd(t, u, tmpv)
		t.ToProjective(r)
	}
	result = new(Key)
	r.ToBytes(result)
	return result
}

func MultiScalarMultKey(points []*Key, scalars []*Key) (result *Key) {
	r := new(ProjectiveGroupElement)


	pointLs := make([]ExtendedGroupElement, len(points))

	digitsLs := make([][64]int8, len(scalars))
	for i:= range digitsLs {
		digitsLs[i] = scalars[i].SignedRadix16()
	}

	AiLs := make([][8]CachedGroupElement, len(scalars))
	for i:= 0; i < len(scalars); i++ {
		// A,2A,3A,4A,5A,6A,7A,8A
		t := new(CompletedGroupElement)
		u := new(ExtendedGroupElement)
		pointLs[i].FromBytes(points[i])
		pointLs[i].ToCached(&AiLs[i][0])
		for j := 0; j < 7; j++ {
			geAdd(t, &pointLs[i], &AiLs[i][j])
			t.ToExtended(u)
			u.ToCached(&AiLs[i][j+1])
		}
	}

	t := new(CompletedGroupElement)
	u := new(ExtendedGroupElement)

	r.Zero()
	cachedBase := new(ExtendedGroupElement)
	cur := new(CachedGroupElement)
	minusCur := new(CachedGroupElement)
	for i := 63; i >= 0; i-- {
		r.Double(t)
		t.ToProjective(r)
		r.Double(t)
		t.ToProjective(r)
		r.Double(t)
		t.ToProjective(r)
		r.Double(t)
		t.ToExtended(u)

		cachedBase.Zero()
		tmpt := new(CompletedGroupElement)
		for j:= 0; j < len(scalars); j++ {
			cur.Zero()
			b := digitsLs[j][i]
			bNegative := int8(negative(int32(b)))
			bAbs := b - (((-bNegative) & b) << 1)

			for k := int32(0); k < 8; k++ {
				if equal(int32(bAbs), k+1) == 1 { // optimisation
					CachedGroupElementCMove(cur, &AiLs[j][k], equal(int32(bAbs), k+1))
				}
			}
			FeCopy(&minusCur.yPlusX, &cur.yMinusX)
			FeCopy(&minusCur.yMinusX, &cur.yPlusX)
			FeCopy(&minusCur.Z, &cur.Z)
			FeNeg(&minusCur.T2d, &cur.T2d)
			CachedGroupElementCMove(cur, minusCur, int32(bNegative))

			geAdd(tmpt, cachedBase, cur)
			tmpt.ToExtended(cachedBase)
		}
		tmpv := new(CachedGroupElement)
		cachedBase.ToCached(tmpv)
		geAdd(t, u, tmpv)
		t.ToProjective(r)
	}
	result = new(Key)
	r.ToBytes(result)
	return result
}